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What is claimed is: 

1 . A method for identifying computer network protocols used to encapsulate 
2 data in a protocol data unit, which comprises the steps of: 

4 receiving the protocol data unit, wherein the protocol data unit comprises 

data and multiple encapsulation protocol patterns; and 

6 

while there remains at least one stage for which the protocol data unit is 
8 to be searched, iteratively performing: 

10 selecting one of the remaining stages, and 

12 while there remains at least one search pattern of the selected 

stage for which the protocol data unit is to be searched, iteratively 
14 performing: 

16 selecting one of the remaining search patterns, and 

18 searching the protocol data unit for the selected search 

pattern. 

2. The method as recited in claim 1 , which further comprises the steps of: 

2 

prior to the while there remains at least one stage iterative loop: 

4 

assigning a group indicator for at least one pre-defmed group of 
6 search patterns, wherein the group comprises at least one sub-set 

which comprises at least one preselected search pattern, wherein 
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8 the preselected search pattern identifies at least one preselected 

network protocol used to encapsulate data; and 

10 

initializing the group indicator to specify that at least one sub-set 
12 is present in the expected locations in the protocol data unit; and 

14 after the while there remains at least one search pattern of the selected 

stage for which the protocol data unit is to be searched iterative loop: 

16 

when all search patterns associated with each sub-set of the group 
1 8 for the selected stage are absent from the expected locations in the 

protocol data unit, setting the group indicator to specify that all 
20 sub-sets of that group are absent from the protocol data unit. 

3. The method as recited in claim 2, which following the method step 
2 searching the protocol data unit for the selected search pattern further 

comprises the step of: 

4 

after the while there remains at least one stage iterative loop: 

6 

when at least one of the sub-sets is present in the expected 
8 locations in the protocol data unit, placing the protocol data unit 

in a buffer. 

4. The method as recited in claim 1 , wherein the method step searching the 
2 protocol data unit for the selected search pattern comprises the steps of: 

4 while there remains at least one part of the search pattern of the selected 

stage for which the protocol data unit is to be searched, iteratively 
6 performing: 
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8 selecting one of the remaining un-searched parts of the selected 

search pattern, and 

10 

searching the protocol data unit for the selected part of the 
1 2 selected search pattern. 

5. The method as recited in claim 4, which further comprises the steps of: 

2 

when the method step searching the protocol data unit for the selected part 
4 of the selected search pattern fails to find the selected part in the protocol 

data unit, 



6 



10 



10 



exiting the while there remains at least one part of the search 
pattern of the selected stage for which the protocol data unit is to 
be searched iterative loop and 



exiting the while there remains at least one search pattern of the 
12 selected stage for which the protocol data unit is to be searched 

iterative loop. 

6. The method as recited in claim 1, which following the method step 
2 selecting one of the remaining search patterns further comprises the steps 

of: 

4 

when there remains at least one additional search pattern of the selected 
6 stage for which the protocol data unit is to be searched, 

8 selecting at least one of the additional remaining search patterns, 

and 



in parallel with the method step of searching the protocol data unit 
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for the selected search pattern, searching the protocol data unit for 
the additional selected search pattern. 



7. The method as recited in claim 6, wherein the parallel method steps of 
2 searching the protocol data unit for the selected search pattern and of 

searching the protocol data unit for the additional selected search pattern 
4 comprise the steps of: 

6 while there remains at least one part of the selected search pattern of the 

selected stage for which the protocol data unit is to be searched and at 

8 least one part of the additional selected search pattern of the selected stage 

for which the protocol data unit is to be searched, iteratively performing: 

10 

selecting one of the remaining un-searched parts of the selected 
12 search pattern, 

1 4 selecting one of the remaining un-searched parts of the additional 

selected search pattern, 

16 

searching the protocol data unit for the selected part of the 
18 selected search pattern, and 



20 in parallel with the method step of searching the protocol data unit 

for the selected part of the selected search pattern, searching the 

22 protocol data unit for the selected part of the additional selected 

search pattern; 

24 

otherwise, while there remains at least one part of the selected search 
26 pattern of the selected stage for which the protocol data unit is to be 

searched, iteratively performing: 

28 
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selecting one of the remaining un-searched parts of the selected 
search pattern, and 



32 searching the protocol data unit for the selected part of the 

selected search pattern; and 

34 

otherwise, while there remains at least one part of the additional selected 
36 search pattern of the selected stage for which the protocol data unit is to 

be searched, iteratively performing: 

38 

selecting one of the remaining un-searched parts of the additional 
40 selected search pattern, and 

42 searching the protocol data unit for the selected part of the 

additional selected search pattern. 

8. The method as recited in claim 7, which further comprises the steps of: 

2 

when the method step searching the protocol data unit for the selected part 
4 of the selected search pattern fails to find the selected part of the selected 

search pattern in the protocol data unit and when the parallel method step 
6 of searching the protocol data unit for the selected part of the additional 

selected search pattern fails to find the selected part of the additional 
8 selected search pattern in the protocol data unit, 

10 exiting the while there remains at least one part of the selected 

search pattern of the selected stage for which the protocol data 

12 unit is to be searched and at least one part of the additional 

selected search pattern of the selected stage for which the protocol 

14 data unit is to be searched iterative loop; 
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16 otherwise when the method step searching the protocol data unit for the 

selected part of the selected search pattern fails to find the selected part 
18 of the selected search pattern in the protocol data unit, 



20 exiting the while there remains at least one part of the selected 

search pattern of the selected stage for which the protocol data 
22 unit is to be searched iterative loop; and 

24 otherwise when the method step searching the protocol data unit for the 

selected part of the additional selected search pattern fails to find the 

26 selected part of the additional selected search pattern in the protocol data 

unit, 

28 

exiting the while there remains at least one part of the additional 
30 selected search pattern of the selected stage for which the protocol 

data unit is to be searched iterative loop. 

9. A storage medium readable by a protocol identification apparatus, 
2 tangibly embodying a computer program of instructions executable by the 

protocol identification apparatus to perform method steps for identifying 
4 computer network protocols used to encapsulate data in a protocol data 

unit, the steps comprising: 

6 

receiving the protocol data unit, wherein the protocol data unit comprises 
8 data and multiple encapsulation protocol patterns; and 

1 0 while there remains at least one stage for which the protocol data unit is 

to be searched, iteratively performing: 



12 



14 



selecting one of the remaining stages, and 
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while there remains at least one search pattern of the selected 

1 6 stage for which the protocol data unit is to be searched, iteratively 

performing: 



18 



20 



selecting one of the remaining search patterns, and 



searching the protocol data unit for the selected search 
22 pattern. 

10. The storage medium as recited in claim 9, the steps further comprising: 

2 

prior to the while there remains at least one stage iterative loop: 

4 

assigning a group indicator for at least one pre-defined group of 
6 search patterns, wherein the group comprises at least one sub-set 

which comprises at least one preselected search pattern, wherein 
8 the preselected search pattern identifies at least one preselected 

network protocol used to encapsulate data; and 

10 

initializing the group indicator to specify that at least one sub-set 
12 is present in the expected locations in the protocol data unit; and 

14 after the while there remains at least one search pattern of the selected 

stage for which the protocol data unit is to be searched iterative loop: 

16 

when all search patterns associated with each sub-set of the group 
1 8 for the selected stage are absent from the expected locations in the 

protocol data unit, setting the group indicator to specify that all 
20 sub-sets of that group are absent from the protocol data unit. 



11. The storage medium as recited in claim 10, wherein following the step 
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searching the protocol data unit for the selected search pattern, the steps 
further comprising: 



after the while there remains at least one stage iterative loop: 

when at least one of the sub-sets is present in the expected 
locations in the protocol data unit, placing the protocol data unit 
in a buffer. 



12. The storage medium as recited in claim 9, wherein the step searching the 
2 protocol data unit for the selected search pattern comprising the steps of: 

4 while there remains at least one part of the search pattern of the selected 

stage for which the protocol data unit is to be searched, iteratively 
6 performing: 



8 selecting one of the remaining un-searched parts of the selected 

search pattern, and 

10 

searching the protocol data unit for the selected part of the 
12 selected search pattern. 



1 3 . The storage medium as recited in claim 1 2, the steps further comprising: 

when the method step searching the protocol data unit for the selected part 
of the selected search pattern fails to find the selected part in the protocol 
data unit, 

exiting the while there remains at least one part of the search 
pattern of the selected stage for which the protocol data unit is to 
be searched iterative loop and 
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10 exiting the while there remains at least one search pattern of the 

selected stage for which the protocol data unit is to be searched 
12 iterative loop. 

14. The storage medium as recited in claim 9, wherein following the method 
2 step selecting one of the remaining search patterns, the steps further 

comprising: 

4 

when there remains at least one additional search pattern of the selected 
6 stage for which the protocol data unit is to be searched, 

8 selecting at least one of the additional remaining search patterns, 

and 

10 

in parallel with the method step of searching the protocol data unit 
1 2 for the selected search pattern, searching the protocol data unit for 

the additional selected search pattern. 

15. The storage medium as recited in claim 14, wherein the parallel method 
2 steps of searching the protocol data unit for the selected search pattern 

and of searching the protocol data unit for the additional selected search 
4 pattern comprise the steps of: 

6 while there remains at least one part of the selected search pattern of the 

selected stage for which the protocol data unit is to be searched and at 

8 least one part of the additional selected search pattern of the selected stage 

for which the protocol data unit is to be searched, iteratively performing: 

10 

selecting one of the remaining un-searched parts of the selected 
12 search pattern, 
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1 4 selecting one of the remaining un-searched parts of the additional 

selected search pattern, 

16 

searching the protocol data unit for the selected part of the 
1 8 selected search pattern, and 

20 in parallel with the method step of searching the protocol data unit 

for the selected part of the selected search pattern, searching the 

22 protocol data unit for the selected part of the additional selected 

search pattern; 

24 

otherwise, while there remains at least one part of the selected search 
2 6 pattern of the selected stage for which the protocol data unit is to be 

searched, iteratively performing: 

28 

selecting one of the remaining un-searched parts of the selected 
30 search pattern, and 

32 searching the protocol data unit for the selected part of the 

selected search pattern; and 

34 

otherwise, while there remains at least one part of the additional selected 
36 search pattern of the selected stage for which the protocol data unit is to 

be searched, iteratively performing: 

38 

selecting one of the remaining un-searched parts of the additional 
40 selected search pattern, and 

42 searching the protocol data unit for the selected part of the 

additional selected search pattern. 
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1 6. The storage medium as recited in claim 1 5, the steps further comprising: 

2 

when the method step searching the protocol data unit for the selected part 
4 of the selected search pattern fails to find the selected part of the selected 

search pattern in the protocol data unit and when the parallel method step 
6 of searching the protocol data unit for the selected part of the additional 

selected search pattern fails to find the selected part of the additional 
8 selected search pattern in the protocol data unit, 

10 exiting the while there remains at least one part of the selected 

search pattern of the selected stage for which the protocol data 

12 unit is to be searched and at least one part of the additional 

selected search pattern of the selected stage for which the protocol 

14 data unit is to be searched iterative loop; 

1 6 otherwise when the method step searching the protocol data unit for the 

selected part of the selected search pattern fails to find the selected part 
1 8 of the selected search pattern in the protocol data unit, 

20 exiting the while there remains at least one part of the selected 

search pattern of the selected stage for which the protocol data 
22 unit is to be searched iterative loop; and 

24 otherwise when the method step searching the protocol data unit for the 

selected part of the additional selected search pattern fails to find the 

26 selected part of the additional selected search pattern in the protocol data 

unit, 

28 

exiting the while there remains at least one part of the additional 
3 0 selected search pattern of the selected stage for which the protocol 

data unit is to be searched iterative loop. 
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17. An apparatus for identifying those computer network protocols used to 
2 encapsulate data in a protocol data unit, comprising: 

4 a control circuit, wherein the control circuit is capable of receiving the 

protocol data unit and is capable of obtaining at least one search pattern 

6 for each of multiple stages, wherein each search pattern identifies one of 

the network protocols used to encapsulate data; and 

8 

a pattern comparator, wherein the pattern comparator is connected to the 
1 0 control circuit, wherein the pattern comparator is capable of receiving the 

protocol data unit from the control circuit, wherein the control circuit is 
12 capable of successively selecting individual stages, and wherein for the 

selected stage the pattern comparator is capable of receiving at least one 
14 search pattern for the selected stage from the control circuit and of 

separately searching the protocol data unit for the received search pattern. 

18. The apparatus as recited in claim 17, wherein the pattern comparator is 
2 capable of separately searching the protocol data unit for part of the 

received search pattern. 

19. The apparatus as recited in claim 17, wherein the pattern comparator is 
2 capable of separately searching the protocol data unit for multiple 

received search patterns in parallel. 



20. 



The apparatus as recited in claim 17, further comprising a first 
accumulator, wherein the first accumulator is connected to the pattern 
comparator and is capable of accumulating results from searches of the 
selected stage. 



The apparatus as recited in claim 20, further comprising: 
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2 a mapping circuit, wherein the mapping circuit is connected to the first 

accumulator and wherein the mapping circuit maps the contents of the 
4 first accumulator against a preselected group of search patterns. 



22. The apparatus as recited in claim 21, further comprising a second 
2 accumulator, wherein the second accumulator is connected to the 

mapping circuit and is capable of accumulating results from maps of the 
4 first accumulator for each stage against the preselected group of search 

patterns. 
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